Reference Library · Read • Investigate • Corroborate

Tools

Choose a tool by the evidence it can inspect, then validate the result on a known input.

Materially reviewed 2026-10-22 · Curated reference

Find a tool by the evidence question

This directory separates acquisition, source parsing, event triage, and analysis workspaces. A tool’s reputation does not validate the specific feature used in a conclusion. Profiles record original sources, applicability, maintenance observations, and integrity concerns.

Filesystem and image analysis

The Sleuth Kit

Which filesystem record supports the recovered name or content?

Cross-platform · Supported disk images and filesystem structures

Case-oriented disk examination

Autopsy

Did a displayed result come from a native record, an ingest module, or an analyst annotation?

Windows · Supported image/data sources and ingest-module outputs

Memory analysis

Volatility 3

What was actually present in this acquisition, and what did the plugin infer from it?

Cross-platform · Supported memory images, symbols and plugin inputs

Event extraction

Plaso

What source event does this normalized timestamp describe?

Cross-platform · Supported artifact files and parser outputs

Collaborative timeline analysis

Timesketch

Which parts of this timeline are source facts and which are analyst-created context?

Cross-platform · Imported event datasets and analyst annotations

Endpoint collection and response

Velociraptor

What did the collection query ask the endpoint to produce?

Cross-platform · Artifact definitions, query results and collected endpoint data

Windows event-log triage

Hayabusa

Does this rule match identify suspicious behavior, or merely a pattern worth checking?

Cross-platform · Supported Windows event logs and detection rules

Event-log search and rule triage

Chainsaw

Can the matched fields be traced back to the original record?

Cross-platform · Supported forensic artifacts, logs and rule mappings

Live endpoint state queries

osquery

Is this a current-state observation or a retained event record?

Cross-platform · Operating-system tables and configured event sources

Metadata inspection

ExifTool

Which metadata container produced this value, and how does it relate to the file?

Cross-platform · Supported media and document metadata structures

Packet capture interpretation

Wireshark

What was captured at this observation point, rather than what happened everywhere on the network?

Cross-platform · Supported packet-capture files and protocol dissection

Application database inspection

SQLite command-line shell

Does the examined database state include the transactions relevant to this collection?

Cross-platform · SQLite databases and relevant companion files

Choose by role, then test

Task	Candidate tools	Question before relying on output
Filesystem examination	The Sleuth Kit, Autopsy	Can the result be relocated in the source image?
Memory structures	Volatility 3	Are the target build, symbols, and captured pages suitable?
Event extraction and triage	Plaso, Hayabusa, Chainsaw	What do the original fields mean, and what was not collected?
Live endpoint state	Velociraptor, osquery	What changed while collection ran, and what query scope applied?
Metadata and application stores	ExifTool, SQLite shell	Which container and transaction state produced the displayed value?
Packets and combined timelines	Wireshark, Timesketch	What did collection omit, and what did analysis add?

All profiles are documentation reviews, not binary safety assessments or benchmarks. The NIST CFTT program provides relevant test-method resources. Use the working templates to preserve inputs, settings, and limitations.